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Abstract 

Daniel Simon's 1994 discovery of an efficient quantum algorithm for solving the hidden 
subgroup problem (HSP) over provided one of the first algebraic problems for which quan- 
tum computers are exponentially faster than their classical counterparts. In this paper, we 
study the generalization of Simon's problem to arbitrary groups. Fixing a finite group G, this is 
the problem of recovering an involution m= (mi, . . . ,m„) G G" from an oracle / with the prop- 
erty that f{x)f{x-y) <J=> y £ {l,m}. In the current parlance, this is the hidden subgroup problem 
(HSP) over groups of the form G", where G is a nonabelian group of constant size, and where 
the hidden subgroup is either trivial or has order two. 

Although groups of the form G" have a simple product structure, they share important 
representation-theoretic properties with the symmetric groups S„, where a solution to the HSP 
would yield a quantum algorithm for Graph Isomorphism. In particular, solving their HSP 
with the so-called "standard method" requires highly entangled measurements on the tensor 
product of many coset states. 

Here we give quantum algorithms with time complexity 2'^(^"'°S") that recover hidden in- 
volutions m = (mi,..., m„ ) G G" where, as in Simon's problem, each m, is either the identity or 
the conjugate of a known element m and there is a character x of G for which xi^^) — ^Z(l)- 
Our approach combines the general idea behind Kuperberg's sieve for dihedral groups with 
the "missing harmonic" approach of Moore and Russell. These are the first nontrivial hidden 
subgroup algorithms for group families that require highly entangled multiregister Fourier 
sampling. 
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^Supported by NSF CAREER award CCR-0093065, NSF grants EIA-0523456 and EIA-0523431, and ARO-ARDA 
grant 47976-PH-QC. 
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1 Introduction 



1.1 Simon's problem over general groups 

Let G be a finite group of even order and suppose we are given access to an oracle function /, from 
G" to some set S, with the property that f{x-y) = f{x) e { 1 , m} for some "hidden" involution 
m G G". Our task is to determine m by querying the oracle /. While this problem is classically 
intractable, a beautiful quantum algorithm of Daniel Simon's solves it efficiently when G = Z2 [18]. 
In this article, we study this problem over general groups. This problem fits into the framework of 
the Hidden Subgroup Problem (HSP), which also underlies Shor's celebrated quantum algorithms 
for factoring and discrete logarithm [17]. In general, an instance of a hidden subgroup problem 
over a group K is described by a function f : K ^ S that "hides" a subgroup H < K in the sense 
that 

f{k)=f{k-h)^heH . (1) 

The problem is to determine the subgroup H by making queries to the function /. For the cases of 
interest in this article, the group ^ = G" is exponentially large, and we measure the complexity of 
algorithms for the problem as a function of log |^| = &{n). Moreover, the subgroup H is of constant 
size, making it easy to rule out the possibility of efficient classical algorithms. 

The number-theoretic problems solved by Shor's algorithms are naturally related to the HSP 
on abelian groups which are, at this point, quite well understood. The HSP on nonabelian groups 
has very exciting algorithmic applications, including Graph Isomorphism and certain lattice prob- 
lems [15]; however, these problem appear to be quite challenging in general. Efficient algorithms 
exist for a number of families of nonabelian groups (e.g., [16, 8, 3, 12, 7, 2]) but all of these are 
"nearly abelian" in one sense or another. In contrast, the groups of greatest interest, the symmetric 
groups Sn whose hidden subgroup problems correspond to Graph Isomorphism, have steadfastly 
resisted the community's advances. A series of negative results [6, 14, 5] have shown that the 
standard approach of measuring a coset state, i. e., a uniform superposition over a random coset 
of H, is inherently limited. The strongest of these results, due to Hallgren et al. [5] shows that 
even to obtain enough information to solve the HSP (regardless of the computational complexity of 
processing this information) any algorithm based on this approach must involve highly entangled 
measurements on the tensor product of ^(log \Sn\) = Q.{n\ogn) coset states. 

In spite of the fact that groups of the form G" have a simple direct product structure, all the 
known negative results that apply to S„ apply in this setting as well. In particular, whenever 
G is nonabelian almost all the representations of G" have dimensions which are exponentially 
large, causing strong Fourier sampling of single coset states to fail [1]. Moreover, solving Simon's 
problem on G" requires highly entangled measurements over n(log |G"|) = ^l(n) coset states. 

In this article, we describe a family of algorithms for Simon's problem on G" so long as there is 
a character XoiG which, as in the original problem on U^, "identifies" nontrivial coordinates of the 
involution. Specifically, we recover hidden subgroups H of the form {1,'m} where, as in Simon's 
original problem, (i.) each is either the identity or the conjugate of a known element jJ. € G and 
(ii.) there is a character X of G for which %{^) = — Our algorithms take time 2'^(^"'°§"). We 
emphasize that these are the first subexponential-time algorithms to which the negative results 
of [14, 5] apply, and for which highly entangled measurements are necessary. 

Our algorithms use an adaptive sieve similar to that employed by Kuperberg in his algorithm 
for the dihedral groups [10]. Specifically, we combine registers pairwise in an effort to generate 
states lying in one-dimensional representations. The rules by which we match pairs of registers 
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together are more complicated than those in the dihedral group, however, and depend on the 
Clebsch-Gordan problem in G. Ultimately, our algorithms produce states which lie in representa- 
tions which are chosen uniformly from the one-dimensional representations of G" which are or- 
thogonal to the hidden subgroup. Their success rests on the fact that, given any order-2 subgroup 

H, at least half of these representations are "missing harmonics" of H and cannot appear [13] 
unless the hidden subgroup is in fact trivial. 

I. 2 The representations of G" 

Recall that a representation of a group K is a homomorphism p : K ^ U(Vp), where U(Vp) is the 
set of unitary operators acting on some vector space Vp, whose dimension we denote hy dp. A 
representation is irreducible if there are no proper subspaces of Vp which are preserved by p (g) for 
all g € K. Schur's Lemma asserts that for any irreducible representation (or "irrep") p, the only 
operators which commute with its image Im p £ U(y) are the scalar matrices AH where A G C. 

We say that two irreps are isomorphic if there is a unitary change of basis that maps one onto 
the other; that is, pi = p2 if there is a T such that pi (g) = T^p2{g)T for all g £ K.lf K is finite, there 
are a finite number of equivalence classes under isomorphism, and we let K denote one irrep from 
each of these equivalence classes. Given an irrep p, its character at a group element k is defined to 
be Xp{^<^) = tr P(^)/ ^rid one-dimensional irreps can be identified with their characters. 

Once a basis is chosen for the spaces Vp of each p & K, the p (g) become explicit matrices, and 
the matrix elements of the irreps in K form a basis for CK, the algebra of complex-valued functions 
on K. The quantum Fourier transform is the change of basis from the group basis 

{\k):keK} 

of CG to the Fourier basis 

{\p,i,j):peKandl<i,j<dp} . (2) 

li p : K ^ \My) is a reducible representation, one may find an orthogonal decomposition Vp = 
V\®---®Vk with the remarkable property that every p (g) preserves each subspace Vj and, more- 
over, that the matrices p,(g) obtained by restricting p(g) to V,- form an irreducible representation. 
In this case we write p = ©,p,. Note that, up to isomorphism, a given representation x ^ K may 
appear many times in such a decomposition. 

We remark that if p and a are representations of a group K, one may naturally define a repre- 
sentation p®o on the space Vp®Va by the "diagonal action": the matrix [p a] (g) is defined to be 
p (g) a(g). Even when p and a are irreducible, the representation p (g) a is, in general, reducible; 
the problem of determining the irreducible constituents of p CJ is the Clebsch-Gordan problem. 

Finally, we mention that the representation theory of a product group decomposes into that 
of its factors. In particular, each irrep p of G" is a tensor product pi® ■ ■ ■ ® Pn of n irreps of G. 
Specifically, p{x) = pi{xi) ® ■ ■ ■ ^ Pn{xn) (note that this differs from the "diagonal" tensor product 
construction described above, since the components of x may differ). The dimension dp of p is 
hence equal to the product of the dimensions of the p„ and the character xp (x) is equal to the 
product xpi (-^i) ■ ■ ■ Xp„ {xn) of the characters of the p; at the xi. 
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2 Previous negative results 



2.1 Weak sampling fails 

The standard approach to the HSP is to create a uniform quantum superposition over the group, 
and then measure the value of the oracle /. This produces the so-called coset state, which is a 
uniform superposition over a random coset of the hidden subgroup H. 

Using the techniques of [11], it is easy to perform the quantum Fourier transform for groups 
of the form G" in poly (n) time. The process of loeak Fourier sampling then consists of measuring just 
the "name" of the representation p G G" (that is, the leading portion of the register in the Fourier 
basis (2)), while strong Fourier sampling also measures the row and column i,j in a basis of our 
choice. We begin by discussing the probability distribution Ph{p) on G" observed under weak 
sampling. This is given by 

^//(P) = ^rkn^ , (3) 

where 

1^1 heH 

is the projection operator formed by averaging the representation p over H. When // = {!}, this is 

often referred to as the Plancherel distribution; this is simply the dimensionwise fraction of CG" 
consisting of copies of p. The following proposition, proved in [1], asserts that if the "base group" 
G possesses an involution outside its center Z(G), then weak sampling cannot solve Simon's prob- 
lem on G": that is, there are many involutions m which it cannot distinguish from each other, and 
indeed it cannot distinguish the order-2 subgroup from the trivial subgroup. 

Proposition 1. Let G be a group with an involution }x ^ Z(G), and let H = {I, (mi, . . . ,m„)} < G", where 
each nii is conjugate to fX. Then the total variation distance between the weak Fourier sampling distributions 
for H and {1} is at most 2^"/^. 

2.2 Strong sampling fails 

Using the machinery of Moore, Russell, and Schulman [14], one can show that performing strong 
Fourier sampling on a single coset state also fails to solve Simon's problem on G" for many choices 
of G. Given a suitable condition on G, a simple application of a Chernoff bound shows that the 
dimension of the irrep p resulting from weak Fourier sampling is exponentially large in n with 
overwhelming probability. It is not hard to use this fact and the results of [14] to show that single- 
register strong Fourier sampling then fails for G"; for details, see the present authors' preprint [1]. 

For a slightly stronger condition on G, Hallgren, Moore, Rotteler, Russell and Sen [5] recently 
showed that entangled measurements over Q.{n) registers are required to distinguish subgroups 
of G". This result applies to many interesting base groups, including all nonabelian simple groups 
and the symmetric groups St for k>4. 

These negative results strongly suggest that there is little hope of developing a generic recur- 
sive approach to the HSP based on breaking the group into a tower of subgroups. Not only can we 
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decompose G" into the tower G" > G"^^ >•••>{!}, but if G is solvable we can further refine this 
tower so that each subgroup is normal and all the quotient groups are abelian. For certain solvable 
groups, Friedl et al. [3] showed that such a tower allows us to solve the HSP recursively. However, 
there are groups to which the results of [1, 5] apply which are solvable and even nilpotent, such as 
the "chandelier groups" formed by the k-fold wreath product Z2 ? • • • ? Z2 and which describe the 
automorphisms of a binary tree of depth k. 

3 An algorithm for the product groups 
3.1 Outline of the algorithm 

In this section, we outline our algorithm for Simon's problem on G" for G of constant size. For 
concreteness, we will describe the case where G is the symmetric group 5^. Our algorithm will 
determine the hidden subgroup H <S'l, given oracle access to a function / satisfying (1), and the 
promise that H is either the trivial subgroup {1} or of the form where m = {m\,m2, . . . ,m„) 

with each m, an odd involution in Sk- Note that for any odd permutation n e St, X±{^) = ~^ = 
—X±{1), where x± '■ Sk ^ C is the sign representation mapping each permutation to its sign. We 
explain how to generalize the algorithm to other base groups and subgroups in Section 4. 

For enhanced readability, we make two additional simplifications in this section. First, our al- 
gorithm will only determine if H is trivial or nontrivial; in Section 3.4 we show how to determine 
the involution m. Second, we put off detailed descriptions of the quantum computational ingre- 
dients of the algorithm until Section 3.3, choosing instead to simply list them here and outline the 
algorithm in terms which require only a basic knowledge of representation theory. These "quan- 
tum ingredients" are efficient in the sense that they require time at most polynomial in n. We thus 
assume that: 

1. We can use the oracle to sample irreps p of S'j^ according to the probability distribution (3). 
In particular, if H is the trivial subgroup, it will sample irreps according to the Plancherel 
distribution. 

2. Given two irreps p and a of S'^, we can "Fourier sample" inside p (X" a. When H is the trivial 
subgroup this results in an irrep f according to the natural distribution induced by its ap- 
pearance in the decomposition of p a into G" -irreps. When H is nontrivial, the distribution 
depends both on H and the history of the algorithm up to that point. 

3. Finally, if we can use (1) and (2) to produce a missing harmonic [13], i.e, one for which 
p(m) = —11, then H is the trivial subgroup. These are exactly the one-dimensional p such 
that the number of p, isomorphic to the sign representation of 5^; is odd. On the other hand, 
producing a one-dimensional p with an even number of sign representations provides evi- 
dence that H is nontrivial. 

Our algorithm will first use (1) to produce a large number of irreps of S^, then use (2) repeatedly 
in a "sieve" to whittle our irreps down to one-dimensional ones, and finally apply (3) to make a 
correct guess about H with overwhelming probability. 

We now discuss our method for selecting irreps to combine via step (2). Suppose we have the 
tensor product of two irreps p and a of S'^. We wish to decompose them into a direct sum of irreps 
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of 5' 



m 



These f are simply tensor products of the T, appearing in the decomposition of p, (g) a, into irreps 
of Sk for each /. Now, if dp. = da^ = 1, then clearly p,- a, consists of a single one-dimensional irrep. 
It is a fact of the representation theory of the symmetric group that if a, is isomorphic to p„ then 
pi (g) (7/ contains one copy of the trivial representation; likewise, if a, is isomorphic to the conjugate 
representation (obtained by flipping p/s Young diagram across its main diagonal) then p, a, 
contains one copy of the sign representation. 

Hence, we would ideally like to use (2) to combine irreps p and a which match up in a nice 
way, i. e., such that p, is one-dimensional exactly when a, is one-dimensional, and such that either 
a = Pi or a, = p,^ for all other indices /. In that case, if H is trivial, each t, would be one-dimensional 
with constant probability. However, producing such pairs of irreps of S'l simply using (1), i. e., 
by independently weak sampling each one, would require exponential time. Instead, we work 
our way towards missing harmonics with a sieve in the spirit of Kuperberg's algorithm for the 
dihedral groups [10]. 

Specifically, we will use (1) to produce a pool of 2®('>/"'°sn) 5^ -irreps, and then repeatedly pair- 
wise combine them using (2) according to the following rule. First, for each p in our pool, we flip 
\/n/\ogn coins, setting Zy = or 1 with equal probability for j = 1 , . . . , -s/n/logn. We then consider 
the ^Jrl/\ogn leftmost indices / for which dp. > 1 . We say that a is a partner for p if, for the j'th 
such index /, we have p,- = a, or p,- = a-^ if = or 1 respectively, and moreover if = zj for all j. 
Observe that there are then at most 



different types of 5^' -irreps for the purposes of this method of matching. Our algorithm relies on 
the fact that if f is produced from p (g a using (2), then whenever p,- = a,- or p,- = a^, we will have 
d^;. = 1 with constant probability. 

The following is an outline of our algorithm. 



• Repeat 6y/nlogn times: 

- Pair up the irreps from A according to the rule specified above, and discard any un- 
paired irreps. 

- Use quantum ingredient (2) to combine each pair of partners to produce a new 5" -irrep. 
Redefine A to be the set of "children" produced in this manner. 

• By quantum ingredient (3), we may output "trivial" if A contains any missing harmonics, 
and "nontrivial" otherwise. 





• Use quantum ingredient (1) to produce a collection A of 2®(v^^^°s«) irreps of S^. 
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Since we never discard more than a constant fraction of the irreps at each step, it is clear that we 
will still have the necessary 2®(^"'°§") irreps at the last step. If H is trivial, it is easy to see that 
every one-dimensional irrep has the same probability of appearing in the final list A since our 
coin-flipping process chooses partners where a,- = p,- or with equal probability. Since half of the 
possible one-dimensional irreps are missing harmonics, the probability that A contains no miss- 
ing harmonics in this case is superexponentially small. Hence the probability the final collection 
contains a missing harmonic is 1 — o(l) if // is trivial, and if it is not. The output is thus correct 
with high probability. 



3.2 Analysis 

Suppose f is a child resulting from applying ingredient (2) to a pair of partners. Let the weight of f 
be the number of its factors T; with d^. > 1 . Ideally, we would like f to satisfy one of the following 
three conditions; 1) the weight of f is zero; 2) the parents have weight at least log n, and the 
weight of f is at least ci^/n/logn lower; 3) the parents have weight less than ^Jn/\ogn and the 
weight of f is lower by a constant fraction C2. Since we know the dimensions of the irreps of Sk 
(which is of constant size), it is easy to select the constants c\ and C2 such that one of these three 
conditions is satisfied with probability at least 1/2, for every child produced in this manner. In the 
following, we assume that these constants have been chosen as prescribed, and that the algorithm 
is run for m = 6yJn\ogn steps. 

Let po be an irrep of sampled at the beginning of the algorithm, and let {pyjyLj be the 
sequence consisting of the descendants of po given in the obvious order (e.g. p2 is the child of pi, 
which is the child of po.) Note that we are assuming that we have selected an irrep produced 
initially via ingredient (1) which has a surviving descendant in the final collection A. Our goal is 
to prove that p„, is one-dimensional (i. e., has weight zero) with very high probability. Define a 
sequence of random variables such that Aj = 1 if py satisfies one of the three conditions 

outlined above, and Aj = otherwise. Notice that 



E 



Aj > -=3^/nlogn , 
7=1 ^ 



but that Pm has weight zero unless 



'^Aj < nlogn + 0{logn) . 



We now define the random variables 

Q = E 



We will control the quantity 



l^Aj {Ar.i<k} 

7=1 



\Cm — Co 



^ = 0, 1,2, . . . ,ni 



Observe that {Q j^'^g defines a (sub)martingale, i. e., E [Ct+i \ Q] > Q, and that |Q+i — Ck\ < 1. We 
can thus apply Azuma's inequality, which asserts that 



Pr 



\Cm - Col > y/n\ogn 



<2e 



-\/n\ognl\2 
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and conclude that, with overwhelming probability. 



Y^Aj > ly'nXogn 

and the weight of pm is zero, as desired. 



3.3 Weak sampling tensor product states and missing harmonics 

Quantum ingredient (1) of our algorithm is the familiar tool of weak Fourier sampling. We con- 
tinue here with a discussion of the slightly less familiar quantum ingredients (2) and (3), for a 
general group G and subgroup H. Recall that at the beginning of the algorithm, each register 
contains the mixed coset state 

Ph = ^,Y.\^H){cH\ , 



\^\ ceG 



where \S) denotes the state 



note that this is the completely mixed state in the case where H is trivial. We then apply weak 
Fourier sampling to each register, projecting it into a right-invariant irreducible subspace of CG 
corresponding to some irrep p of G. We remark at this point that the density matrix pn is invariant 
under right multiplication by any element ofH; in particular, 

RhpH = PhRii = PH (4) 

where Rh is the unitary operator Rj, : \g) \gh) corresponding to (right) multiplication by an el- 
ement h e H. Note that this is stronger than the property that pn commutes with /?/„ which is 
another sense in which a mixed state can be invariant imder a unitary operator. 

The "combine" step of our algorithm consists of the following sampling procedure, identical 
to that used by Kuperberg [10] for the dihedral groups. First, a pair of these weakly sampled 
registers can be described as a state in the vector space 

Vp0VaCCG<S) CG 

where Vp and Va are irreducible right-invariant spaces of CG corresponding to irreps p and a. 
When Vp (g) Va is treated as a representation of G under the right diagonal action it is typically 
reducible, as stated in Section 1.2: its Clebsch-Gordan decomposition is the direct sum Vp®Va = 
©tVVt, where, for an irrep T, is the span of all subspaces of Vp Va isomorphic to T. We call 
such a subspace isotypic. Our goal is to perform "isotypic sampling" on this tensor product state: 
in other words, to measure the irrep name T corresponding to the isotypic subspace W^. 

If \ y) is our original state in Vp (E)Va, let Iyt) denote the projection of \ y) into W^. We begin by 
applying the controUed-multiplication operation to the entire space CG ® CG defined by 

M: \a)\b) ^ \a)\ba-^). 

As pointed out in [10], this unitary transformation transports the right diagonal G-action to the G- 
action on the first register. Therefore, we can now apply the quantum Fourier transform to the first 
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register of the result and measure a representation name T. The portions of this first register corre- 
sponding to a state in a right G-invariant space (a "column" of t) are kept; all other portions of this 
register and the right hand register are left unmeasured (and unused!). By computing the internal 
trace across these qubits, we see that the resulting mixed state is precisely the one we wanted: the 
irrep name T is measured with probability || | Yt) |P- Moreover, as promised in ingredient (2), when 
H is the trivial subgroup we have the fully mixed state at each point of the algorithm and hence 
the probability of observing T is precisely dimWr/(dimVp -dimVa), the dimensionwise fraction of 
Vp (8) Vff composed of copies of T. This establishes the claims of ingredient (2). 

Note, however, that when the subgroup H is nontrivial the distribution induced by the ob- 
servation above may be rather complicated, depending both on the subgroup H and the exact 
sequence of measurements that resulted in the states present in Va and V^. The only fact we shall 
use about the states produced at intermediate stages of the algorithm for nontrivial H, however, is 
that the combine step preserves invariance under right multiplication by elements of H. Indeed, 
if ttp and are mixed states over the spaces Vp and Va, respectively, satisfying property (4) then 
indeed 

{Rh(S)Rh) ■ {oCp aa) = (RhOCp) ® (RhOCa) = ttp iX" Wct 

and the resulting mixed state on Vp ® V^ is invariant under right (diagonal) multiplication by h. 
Returning to the case where G = S1 and 

H = {l,m = {mi,...,mk)} , 

note that if p = pi (g) • • • p„ is a one-dimensional representation of G" in which the number of p, 
isomorphic to the sign representation is odd, then p(l) = 1 while p(m) = -1. Thus the projection 
operator = (1/2) +/?,„) is the zero operator, and p is a missing harmonic in the sense of [13]. 
Since there are no mixed states a over Vp with the property that Rh(X = a for all h^H, such a p can 
never be observed in the course of the sieve process. This establishes the statement in ingredient 
(3). 

3.4 Determining the hidden subgroup 

We now describe how the above algorithm, which determines only if the hidden subgroup is the 
trivial subgroup, can be used to determine H exactly in the case H = {l,m}. For each / from 1 to n, 
and each odd involution b G Sk, we will apply our algorithm to determine if = b. To accomplish 
this, we run the algorithm with the modified oracle defined by 

fii8) = imM8i)) , 

where Cb{gi) returns the coset representative of the coset of {l,b} containing gj. If m,- = b, then fl' 
will be distinct and constant on the cosets of H, and the algorithm will output that the subgroup 
is nontrivial. Otherwise, fi will be one-to-one and the algorithm will output that the subgroup is 
trivial. Repeating this process for every /, and every b, we can fully determine m. 

We have assumed throughout this section that when H is nontrivial, every coordinate of the 
hidden involution m is nontrivial. We show in Section 4.2 how to determine which coordinates are 
nontrivial and so relax this assumption. 
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4 Generalizing to other base groups 



4.1 High-dimensional missing harmonics 

While our exposition above focused on symmetric base groups G = St, our algorithm can be gen- 
eralized to a much larger family of groups. Most generally, we consider base groups G with an 
involution and an irrep p such that p(/x) = — 1. This turns out to be equivalent to a nice group- 
theoretic condition, as the following proposition shows: 

Proposition 2. Let G be a group with an involution }x. The following statements are equivalent: 

1. There is a p eG such that p(/x) = —1. 

2. There is a normal subgroup NofG such that jx and iiN G Z{G/N). 

Proof. First, assume (1) and let A'^ denote the kernel of p. Then certainly jj, ^N. Also, G/N = lm p 
via the isomorphism ^A'^ Pfe)/ arid p(jU) = — U G Z(Im p). 

Conversely, assume (2) and choose any irrep p' of G/N which takes a nontrivial value on IJ.N. 
We can pull p' back to a G-irrep p via p(g) = p'{gN). Since nN G Z{G/N),p{}x) = p'{}xN) = Al by 
Schur's Lemma, and since fi^ = I, we have A = — 1. □ 

With base group G as above, our general algorithm will identify subgroups of the form H = 
{l,m} <G" where each m, is 1 or a conjugate of /i. Our algorithm for S'l above relied on the fact that 
the sign representation of Sk is one-dimensional. However, given the condition of Proposition 2, 
the dimension of p could certainly be greater than one. This problem is easily overcome by treating 
this Simon's problem over K" rather than G", where K is the projective kernel of p, i. e., the subgroup 
of G consisting of elements g such that p (g) is a scalar. Indeed, as K is normal, it contains the 
conjugates of jJ., and hence H < K". Furthermore, the restriction oi p to K decomposes into dp 
copies of some one-dimensional irrep of K, and thus 

dp 

Res^pU) = 0zU) 

(=1 

for some character X- In particular, p(ju) = — U implies = — 1, reducing to the previous situa- 
tion where the missing harmonic is one-dimensional. 

4.2 One-dimensional missing harmonics and determining nontrivial coordinates 

Let G be a group, let /i be an involution, and let G' = [G, G] denote the commutator subgroup of G. 
Since G/G' is abelian, the existence of a character Z G such that = — 1 is equivalent to the 
condition /i ^ G'. Under this condition on the base group G, we consider the HSP over G" where 
the hidden subgroup is H = where each ni, is either 1 or a conjugate of jJ.. Indeed, this is 

the case in the original Simon's problem, where jJ. is the nonidentity element of Z2, and X is the 
nontrivial character. 

To adapt our algorithm to the case described above, we make one simple modification. For 
the symmetric base group case, we paired S^-irreps p according to a rule which attempted to pair 
S^;-factors p, with either p? or pj^ = p? 71, where n is the sign character of Sk- Instead, we will now 
pair a G-factor p, with p* Y' where i//^ is a one-dimensional representation of G selected uniformly 
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at random. Note that since p,- (8) p* contains a copy of the trivial representation, p,- p* Cg) i/a will 
contain a copy of Y' ^rid hence each pairing made in this fashion will allow our algorithm to make 
progress, as before. The final collection Agnd of irreps will thus consist entirely of one-dimensional 
representations of G". To see how we can determine the nontrivial coordinates of m, we now show 
that these final irreps will in fact be uniformly random elements of 

= ^G" '■ V one-dimensional,// C ker , 

i. e. the one-dimensional representations of G" which take the value 1 on H. Since characters 
outside take the value — 1 on m, they cannot appear in Agnd since they are missing harmonics, 
as before. It thus suffices to show that the distribution which dictates the appearance of irreps 
in Agnd is invariant under multiplication (tensor product) by any element of H^. We accomplish 
this by demonstrating, given y G and p € Agnd/ ari "alternate history" of the algorithm which 
instead produces p®Y with the same probability. 

We first remark that the formalism of quantum mechanics does not distinguish between the 
state 10) and A when A € C; indeed, they determine the same density matrix. In particular, 
letting A-j^ be the operator Y,gX{g) \g) {g\ we have A;^. \cH) = x{c) \H) whenever % G H^; thus pn is 
invariant under A;^; for any % £ Note, furthermore, that for any element / G CG, 

f{p®X)=Y.Pisms)f{8)=AJ{p) . (5) 

g 

Evidently, for x G the representations p and p^X equally likely to appear as initial irreps 
in our sieve and, moreover, the mixed state observed in these two cases is equivalent (under the 
natural isomorphism of the vector spaces on which p and p ®X operate). 

The sieve history of our final p G Ag^d is described by a (directed) binary tree whose vertices 
are decorated with the G" -irreps measured at the point when the two children were combined; 
the leaves are labeled by initially sampled irreps. We also associate with each vertex the mixed 
state produced by sampling the states of the children. Our alternate history is described simply 
by choosing any (directed) path that begins with p and ends with some initially sampled irrep, 
and applying the tensor product by i// to the label of each vertex along that path; as x ^ H^, it 
is one-dimensional, and the labels along the path still correspond to irreps. The rest of the tree 
remains unchanged. 

Recall that each internal node in the tree corresponds to an application of quantum ingredient 
(2), which produces a new child state in an isotypic subspace from parents lying in irreps p 
and a. Observe, first of all, that if p a = f and x £ H^, then p ^ {a ^ x) = ® ^ ® Z- At the 
very least, this new labeling of the tree is consistent with decomposition of tensor products into 
their constituent isotypic spaces. Note, also, that as the matching algorithm pairs a representation 
p uniformly with representations p ^Y (for one-dimensional Y)r the probability associated with 
each "combine" step is unchanged. 

Finally, note that if p and X ^re representations of G", with x one-dimensional as above, then 
there is an isomorphism between the space on which p acts and the space on which p®X sets 
which preserves the decomposition of these spaces into irreducible subspaces. For concreteness, 
we may treat these spaces to be the same in the original and alternate trees above (where the only 
difference in G's action on the subspaces is by a scalar given by x)' in particular, the projection 
operators associated with the measurements occurring at each combine step are identical. By (5), 
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the mixed state appearing at the leaf involved in the relabeling is also unaffected by this process, 
as desired. Hence, the final irreps are selected uniformly at random from H^. Since we required 
that /I ^ G' , we can now efficiently determine the nontrivial coordinates of fh by linear algebra, just 
as in Simon's original algorithm. 

4.3 Examples 

The case described in the previous section can provide us with a large family of familiar examples 
of base groups. If G has a subgroup K of index 2, then ^ is normal with G/^ = Z2. It follows that G 
has a one-dimensional representation n, analogous to the sign representation in Sk, which is + 1 on 
K and — 1 on the nontrivial coset of K. Thus TT is a missing harmonic for any involution jJ. ^ K, and 
we can distinguish subgroups of the form H = {l,}n} for m = (mi,m2, . . . ,wi„) where each m,- is 1 or 
an involution outside K. In the case G = Sk studied above, K is the alternating subgroup A/c and 
71 is simply the sign representation. Similarly, if G is a dihedral group Dt, the normal subgroup 
K = Zk consists of the rotations. Finally, if G is a wreath product of the form L I Z2, then K = Lx L. 
For a detailed description of the irreps of G in this case, see [1]. 

References 

[1] Gorjan Alagic, Cristopher Moore, Alexander Russell. Strong Fourier Sampling Fails over G". 
Preprint, quant-ph/0511054 (2005). 

[2] David Bacon, Andrew Childs, and Wim van Dam. From optimal measurement to efficient 
quantum algorithms for the hidden subgroup problem over semidirect product groups. Proc. 
46th Symposium on Foundations of Computer Science, 2005. 

[3] Katalin Friedl, Gabor Ivanyos, Frederic Magniez, Miklos Santha, and Pranab Sen. Hidden 
translation and orbit coset in quantum computing. Proc. 35th ACM Symposium on Theory of 
Computing, 2003. 

[4] William Fulton and Joe Harris. Representation Theory: A First Course. Number 129 in Graduate 
Texts in Mathematics. Springer- Verlag, 1991. 

[5] Sean Hallgren, Cristopher Moore, Martin Rotteler, Alexander Russell, and Pranab Sen. Limi- 
tations of quantum coset states for graph isomorphism. Proc. 38th ACM Symposium on Theory 
of Computing, 2006. 

[6] Sean Hallgren, Alexander Russell, and Amnon Ta-Shma. Normal subgroup reconstruction 
and quantum computation using group representations. Proc. 32nd ACM Symposium on The- 
ory of Computing, pages 627-635, 2000. 

[7] Yoshifumi Inui and Frangois Le Gall. An efficient algorithm for the hidden subgroup problem 
over a class of semi-direct product groups. Proc. EQIS 2004. 

[8] Gabor Ivanyos, Frederic Magniez, and Miklos Santha. Efficient quantum algorithms for some 
instances of the non-abelian hidden subgroup problem. Int. }. Found. Comput. Sci. 14(5): 723- 
740, 2003. 



12 



[9] A.Yu. Kitaev, A.H. Shen, M.N.Vyalyi, Classical and Quantum Computation. Graduate Studies 
in Mathematics, Vol. 47, AMS (2002). 

[10] Greg Kuperberg. A subexponential-time quantum algorithm for the dihedral hidden sub- 
group problem. SIAM Journal on Computing, 35(1):170-188, 2005. 

[11] Cristopher Moore, Daniel Rockmore, Alexander Russell. Generic Quantum Fourier Trans- 
forms. Proc. 15th Annual ACM-SIAM Symposium on Discrete Algorithms, pages 778-787, 2004. 

[12] Cristopher Moore, Daniel Rockmore, Alexander Russell, and Leonard Schulman. The value 
of basis selection in Fourier sampling: hidden subgroup problems for affine groups. Proc. 
15th Annual ACM-SIAM Symposium on Discrete Algorithms, pages 1113-1122, 2004. 

[13] Cristopher Moore and Alexander Russell. Explicit Multiregister Measurements for Hidden 
Subgroup Problems; or, Fourier Sampling Strikes Back. Preprint, quant-ph/0504067 (2005). 

[14] Cristopher Moore, Alexander Russell, Leonard Schulman. The symmetric group defies strong 
Fourier sampling. Proc. 46th IEEE Symposium on Foundations of Computer Science, pages 
479-488, 2005. 

[15] Oded Regev. Quantum computation and lattice problems. Proc. 43rd Symposium on Founda- 
tions of Computer Science, pages 520-530, 2002. 

[16] Martin Rotteler and Thomas Beth. Polynomial-time solution to the hidden subgroup problem 
for a class of non-abelian groups. Preprint, quant-ph/9812070 (1998). 

[17] Peter Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a 
quantum computer. SIAM Journal on Computing, 26(5):1484-1509. 

[18] Daniel Simon. On the Power of Quantum Computation. SIAM Journal on Computing, 26(5). 



13 



